SSRF Flaw in Fintech Platform Allowed for Compromise of Bank Accounts

A server-side request forgery SSRF flaw in an API of a large financial technology fintech platform potentially could have compromised millions of bank customers, allowing attackers to defraud clients by controlling their bank accounts and funds, researchers have found. A team at Salt Security’s...

CVE-2022-28116

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

CVE-2022-28116

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

CVE-2022-28116

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

Sql injection

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

CVE-2022-28116

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

CVE-2022-28116

CVE-2022-28116 affects Online Banking System v1.0. The issue is a SQL injection via the id parameter, described in the CVE entry. CVSS v3.1 reports a base score of 9.8 (CRITICAL) with network attack, no privileges, and no user interaction required, impacting confidentiality, integrity, and availa...

Banking System SQL注入漏洞

Banking System is a simple banking system project by Carlo Montero's personal developer. It is used to manage bank customers' accounts and process their basic transactions. Online Banking System v1.0 has a security vulnerability that allows an attacker to perform SQL injection via the id paramete...

CVE-2022-26646

Online Banking System Protect v1.0 was discovered to contain a local file inclusion LFI vulnerability via the pages parameter...

CVE-2022-26644

Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via parameters on user profile, systeminfo and accounts management...

CVE-2022-26646

Online Banking System Protect v1.0 was discovered to contain a local file inclusion LFI vulnerability via the pages parameter...

CVE-2022-26644

Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via parameters on user profile, systeminfo and accounts management...

CVE-2022-26644

Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via parameters on user profile, systeminfo and accounts management...

CVE-2022-26645

A remote code execution RCE vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function...

CVE-2022-26645

A remote code execution RCE vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function...

Remote code execution

A remote code execution RCE vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function...

Design/Logic Flaw

Online Banking System Protect v1.0 was discovered to contain a local file inclusion LFI vulnerability via the pages parameter...

CVE-2022-26644

The CVE-2022-26644 entry concerns Online Banking System Protect v1.0 with multiple cross-site scripting (XSS) flaws exploitable through parameters on user profile, system_info, and accounts management. This is documented across multiple sources (NVD/Red Hat and PT Security). Root cause is XSS in ...

CVE-2022-26644

Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via parameters on user profile, systeminfo and accounts management...

CVE-2022-26646

CVE-2022-26646 affects Online Banking System Protect v1.0 via a local file inclusion (LFI) vulnerability driven by the pages parameter. Several connected sources confirm an unauthenticated LFI that can read internal PHP files and, per an exploit reference, enable privilege escalation from a null ...